A private, sandboxed Claude Code or Codex agent for you and your team — launch it in your own AWS account with one click.

Launch on AWS View on GitHub

What it is

A ready-to-use coding agent you open right in your browser. Set it up once with a single click; it keeps running on its own.

Locked down by default

Each agent runs in its own restricted account and can't touch the rest of the machine — it only gets the specific extra powers you choose to grant. The agent's own approval prompts are off by default: the sandbox, not the agent, is the containment. Read the security model →

Works in your browser

A full terminal, right in your browser over a secure connection. Open your link and you're in — nothing to install.

Choose your agent

Pick Claude Code or Codex when you launch. The same NixOS module, terminal, and sandboxing model support both.

Keeps your keys where you put them

API keys and tokens live in a root-only file on your box — out of shared settings, never baked into saved images. The agent can use whatever you hand it, so grant tokens scoped to what it should do.

Honest cost

Runs on a Spot instance with no network fees by default: a small box is ~$7–10/month all-in, the default size ~$16–20/month, on-demand a bit more. Terminate anytime to stop charges.

1-click AWS launch

Sets up one ready-to-go box in your own AWS account with the browser terminal already running. It creates everything it needs, so there's nothing to configure beforehand — just pick a region and go.

N. Virginia
us-east-1
Launch →
Oregon
us-west-2
Launch →
Frankfurt
eu-central-1
Launch →
Ireland
eu-west-1
Launch →
Set a password you'll remember. On the AWS form, type any 16–64 character password into WebPassword — that's what you'll use to log into the browser terminal. AWS masks it with dots after you type it and never shows it again, so save it somewhere before you launch. Choose Claude Code or Codex, pick a size, rename the stack if you want a friendlier Claude app label, and launch. The box takes about 2–3 minutes to start; your browser link then appears under Outputs in the AWS console — open it, enter the password, finish the selected agent's one-time sign-in, and you're in. (Claude Code stacks can drive the box from the Claude desktop / mobile app via Remote Control after the first browser login — the session name is <UserName>@<stack name>, agent@agent-box by default.)
The optional ~$3.60/month, explained. By default the box skips the one thing AWS charges for on the network side — a public IPv4 address — so connectivity costs $0/month, using a free IPv6 address instead. That works fine if the networks you connect from support IPv6 (most home connections do), but offices and public Wi-Fi often don't. Checking PublicIpv4 on the AWS form adds a stable IPv4 for ~$3.60/month. The box itself reaches IPv4-only sites either way: in IPv6-only mode, traffic to them — notably github.com — goes through a free public NAT64 relay (nat64.net). TLS and SSH stay end-to-end encrypted, but if you'd rather not route through a third party, launch with Nat64 unchecked or pay for the IPv4.

Other ways to run

If your team already has its own server, or prefers a downloadable virtual-machine image, the same setup is available for your IT team to install.

Setup instructions live in the project repository.